ChangeLog/8.1

System emulation

Removed features and incompatible changes

Consult the 'Removed features' page for details of suggested replacement functionality.

New deprecated options and features

Consult the "Deprecated Features" chapter of the QEMU System Emulation User's Guide for further details of the deprecations and their suggested replacements.

• The "-singlestep" command line option is deprecated, as it was very misleadingly named. Its replacement is "-one-insn-per-tb" (for the user-mode emulator) or "-accel one-insn-per-tb=on" (for the system-mode emulator)
• The "-fsdev proxy" and "-virtfs proxy" command line options are deprecated (commit / notes).

Arm

• KVM VMs on a host which supports MTE (the Memory Tagging Extension) can now use MTE in the guest
• Pointer-authentication information is now reported to the gdbstub (a GDB 13 or later will produce better backtraces when pauth is in use by the guest)
• Orangepi-PC, Cubieboard: Add Allwinner WDT watchdog emulation
• mcimxd7-sabre, mcimx6ul-evk: The second ethernet controller PHY is now usable
• fsl-imx6: The SNVS is now implemented, sufficient for the guest to be able to shut down the machine
• The SMMUv3 model can now emulate stage-2 translations (but only as an alternative to, not together with, stage-1)
• Debugging via the gdbstub is now supported when using the hvf acceleration on macos hosts
• xlnx-versal board now emulates a CANFD controller
• sbsa-ref now provides the GIC ITS
• New board model: bpim2u (Banana Pi BPI-M2 Ultra)
• TCG plugin memory instrumentation now catches all SVE accesses
• New CPU type: neoverse-v1 (Cortex Neoverse-V1)
• AES instructions can use AES acceleration on the host processor
• New architectural features now emulated:
  • FEAT_PAN3 (Support for SCTLR_ELx.EPAN)
  • FEAT_LSE2 (Large System Extensions v2)
  • FEAT_RME (Realm Management Extensions) -- support is currently experimental only

Hexagon

• v68 scalar insns
• v68 HVX insns
• v69 HVX insns
• v73 scalar instructions
• gdbstub support for HVX

HPPA

• New SeaBIOS-hppa version 8 firmware
• Fixes boot failure of Debian-12 install CD-ROM (ramdisc could not be loaded)
• Fixes operating system boot and reboot issues on HP-UX and Linux with SMP installations
• Enables PSW-Q bit by default (for MPE-UX operating system)
• Show QEMU version in firmware boot menu
• Adds EXIT menu entry to firmware boot menu
• Enhances PDC CHASSIS codes debug possibilty

LoongArch

• Implement LSX extension
• Various fixes

MIPS

• Support for emulation of MXU instructions
• Support for XBurstR1 and XBurstR2 CPUs from Ingenic

OpenRISC

• Allow FPCSR special purpose register to be accessed in user mode
• Configure FPU to detecting tininess before rounding to align QEMU with architecture specification

PowerPC

• TCG SMT support, allowing pseries and powernv to run with up to 8 threads per core
• Fix timebase synchronisation improving stability of SMP machines that update TB (e.g., powernv running KVM)
• Implement PMU interrupt for POWER CPUs, enabling perf to sample cycle counter
• ppc440 cleanups
• Power9 DD2.2 CPU model
• Use SMT4 small core PVRs for Power9/Power10
• XIVE2 model improvements
• Decrimenter, larx/stdx, doorbell, PMU correctness improvements
• GDB debugging fixes
• Power10 xscom models
• Support for irq monitor command
• AES instructions can use AES acceleration on the host processor

RISC-V

ISA and Extensions

• Support subsets of code size reduction extension
• A large collection of mstatus sum changes and cleanups
• Zero init APLIC internal state
• Implement query-cpu-definitions
• Fix Guest Physical Address Translation
• Make sure an exception is raised if a pte is malformed
• Move zc* out of the experimental properties
• Mask the implicitly enabled extensions in isa_string based on priv version
• Updates and improvements for Smstateen
• Support disas for Zcm* extensions
• Support disas for Z*inx extensions
• Add vector registers to log
• AES instructions can use AES acceleration on the host processor
• Add disassembly support for XVentanaCondOps
• Add disassembly support for XThead* instructions
• Add syscall riscv_hwprobe
• Add support for BF16 extensions
• Add support for the Zfa extension

Machines

• Add signature dump function for spike to run ACT tests
• Add Ventana's Veyron V1 CPU
• Assume M-mode FW in pflash0 only when "-bios none"
• Support using pflash via -blockdev option
• Fix veyron-v1 CPU properties
• opensbi: Upgrade from v1.2 to v1.3.1
• Support the watchdog timer of HiFive 1 rev b
• Add RVV registers to log

Fixes and Misc

• Fix invalid riscv,event-to-mhpmcounters entry
• Fix itrigger when icount is used
• Fix mstatus.MPP related support
• Fix the H extension TVM trap
• Restore the predicate() NULL check behavior
• Skip Vector set tail when vta is zero
• Fixup PMP TLB cacheing errors
• Writing to pmpaddr and MML/MMWP correctly triggers TLB flushes
• Fixup PMP bypass checks
• Deny access if access is partially inside a PMP entry
• Fix QEMU crash when NUMA nodes exceed available CPUs
• Fix pointer mask transformation for vector address
• Remove the check for extra Vector tail elements
• Smepmp: Return error when access permission not allowed in PMP
• Fixes for smsiaddrcfg and smsiaddrcfgh in AIA
• Use xl instead of mxl for disassemble
• Fix mstatus related problems
• Fix the xlen for data address when MPRV=1
• Only build qemu-system-riscv$$ on rv$$ host
• Generate devicetree only after machine initialization is complete
• virt: Convert fdt_load_addr to uint64_t
• KVM: fixes and enhancements
• Fix LMUL check to use VLEN
• Fix typo field in NUMA error_report
• Fix disas output of upper immediates

s390x

• Fixed emulation of LDER, LCBB, LOCFHR, MXDB, MXDBR, EPSW, MDEB, MDEBR, MVCRL, LRA, CKSM, CLM, ICM, MC and CLGEBR(A) instructions
• Fixed CPU address returned by STIDP
• Fixed a problem with the EXECUTE instruction and relative branches
• Make the s390-ccw bios compilable with Clang in conjunction with binutils 2.40

SPARC

• Fix block device error when trying to boot niagara machine
• Allow keyboard language DIP switches to be set via the -global escc.chnA-sunkbd-layout option
• Update target/sparc to use tcg_gen_lookup_and_goto_ptr() for improved performance

Tricore

• Handles PCXI and ICR registers correctly for ISA version 1.6.1 upwards
• Added POPCNT.W, LHA, CRC32L.W, CRC32.B, SHUFFLE, SYSCALL, and DISABLE instructions
• Implemented privilege levels
• Introduced TC37x CPU that supports ISA v1.6.2
• Fix out of bounds index for instructions using 64 register pairs

x86

• New CPU model GraniteRapids.
• Default to SMBIOS 3.0 information

TCG

• The following features are now exposed by TCG (but were already implemented): RDSEED, XSAVEERPTR, 3DNOWPREFETCH, WBNOINVD
• RDPID is now implemented by TCG
• SYSCALL is now implemented by TCG in 32-bit emulators (only for AMD processors; Intel processors hide the feature unless the processor is in long mode).
• AES instructions can use AES acceleration on the host processor

Device emulation and assignment

Input devices

• add "virtio-multitouch-pci", a multitouch-capable input device

Network devices

• Improved e1000e and igb emulation
• New CANFD controller emulation, Xilinx Versal

PCI/PCIe

• New QMP commands to inject CXL General Media events, DRAM events and Memory Module events

SD card

• Added support for the sun40i-a64 SoC

TPM

• Added TPM TIS I2C device model

VFIO

• VFIO migration is not experimental anymore
• Support for transferring VFIO device data while the VM is still running

virtio

• asymmetric crypto support for cryptodev-vhost-user
• virtio-blk: zoned device emulation
• virtio-mem: device unplug support (once a device no longer provides any memory: size == 0)
• virtio-mem: support for "x-ignore-shared" migration
• vhost-user-scmi: new vhost-user device for VIRTIO SCMI

vDPA

• shadow virtqueue offload support for vhost-vdpa

9pfs

• Security fix for CVE-2023-2861.
• 'Proxy' backend is deprecated.

Audio

• new PipeWire audio backend (-audiodev pipewire)

Character devices

• It's now possible to specify the input independently from the output with -chardev file (e.g. -chardev file,id=repro,path=/dev/null,input-path=input.txt)

GUI

• gtk: enable multi-touch events
• sdl: various keyboard grab fixes
• dbus: add multi-touch and win32 support
• vnc: a crash in TLS handshake handling when multiple clients connect was fixed (CVE-2023-3354)

GDBStub

• debugging linux-user guests now report correct pid
• now support "info proc" and the host IO features
• properly respond to "b" packet when reverse debugging

TCG Plugins

• cputlb API change now forces slow path for all memory helpers under instrumentation

Block device backends and tools

• ssh ... "qemu-nbd -c /dev/nbd$N ..." no longer hangs waiting for the qemu-nbd process to end (fixing a regression introduced in v4.1.0).

Tracing

• The final parts of per-vcpu trace events where removed. Those looking to monitor TCG code should look at https://qemu.readthedocs.io/en/latest/devel/tcg-plugins.html

Miscellaneous

• Command-line parsing of sizes using a fraction of a scale (such as "1.5M") has been improved: it is now possible to write ".5G" as a synonym for "512M", and no longer possible to cause qemu to read out of bounds on garbage input such as "9.999e999".

User-mode emulation

runtime

• Fixed fcntl() and fcntl64() to return O_LARGEFILE for 32-bit targets
• Added correct checks for accept4(SOCK_NONBLOCK) syscall flags
• Fixed accept4(SOCK_NONBLOCK) syscall for hppa, mips and alpha targets
• Enchanced strace output for pread64() and pwrite64()
• Fix strace output for old_mmap (32-bit guests)
• QEMU can emulate /proc/self/smaps
• Several gdbstub bugfixes and improvements
• Fixed various regressions which were introduced by shrinkable brk() syscall

armhf

• Fix qemu-arm to run static armhf binaries again

s390

• Support for ELF hwcaps

x86

• On Linux, qemu-i386 will run 32-bit programs as if they were ran by a 64-bit kernel, if the chosen CPU model includes the LM feature. This includes the ability to execute system calls using the SYSCALL instruction
• The SYSCALL instruction can also be used with qemu-i386 on 32-bit AMD CPU models
• User-mode emulation will not warn about features that TCG does not implement, if those features are not visible to user mode (e.g. PCID)
• The newly-implemented RDPID instruction will return the current CPU and NUMA node ids

TCG backends

• Generated TCG code respects guest memory ordering even on weakly-ordered machines, allowing parallel emulation of e.g. x86 on ARM

RISC-V

• Support Zba, Zbb, and Zicond standard extensions.

Guest agent

• The guest-exec command supports values "stdout", "stderr", "merged" values for the capture-output parameter. The true and false values for the parameter can also be written as "separated" and "none" respectively.
• The guest-get-fsinfo command can return "usb" as the bus type too.
• Add logging into VSS part (Windows only).
• Add new option "allow-rpcs". The "allow-rpcs" option accepts a comma-separated list of RPCs to enable. This option is opposite to "block-rpcs".
• Fix suspend on Linux guests without systemd.

Build Information

Build Dependencies

• The --meson and --sphinx-build options to configure have been removed. Meson and Sphinx will always be invoked through the Python interpreter specified (optionally) with --python or the $PYTHON environment variable; in order to use a host installation of Meson or Sphinx, the corresponding distribution packages (including metadata) will have to be installed in the site-packages directory of that Python interpreter.
• A new option --enable-download will direct configure to find some missing Python build dependencies. For now this applies to sphinx (downloaded from PyPI) and libslirp (which is then built as a meson subproject). Only required and explicitly enabled dependencies (e.g. only for --enable-docs in the case of Sphinx) are downloaded.
• New Python build dependencies:
  • venv (part of the standard library but sometimes placed in a separate package such as Debian's python3-venv).
  • Either pip+setuptools or ensurepip. Debian puts ensurepip in python3-venv; some versions of NetBSD require py310-expat or a similar package to correctly run ensurepip. Note that configure will not require network access unless --enable-download is specified.
  • It is recommended to install distlib as well, but the build process tries to cope with its absence and it shouldn't be necessary.
  • The use of subprojects/wrapdb.json (downloaded by "meson wrap update-db") isn't supported yet.
• Starting with QEMU 8.1, only Python 3.8 and newer will be supported (3.7 might work but it is not included in any of the environments that we run CI with).
• new pipewire audio backend requires libpipewire (currently >= 0.3.60)
• Xen versions below 4.7.1 are not supported anymore.

Testing and CI

• riscv-cross image now using lcitool

Known issues

• see Planning/8.1